Hamas-linked app offers window into cyber infrastructure, possible links to Iran | CyberScoop<\/title> <meta name=\"description\" content=\"The administrators of a news site linked to Hamas have struggled to keep it online amid fighting with Israel.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/hamas-app-telegram-iran\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Hamas-linked app offers window into cyber infrastructure, possible links to Iran\"> <meta property=\"og:description\" content=\"The administrators of a news site linked to Hamas have struggled to keep it online amid fighting with Israel.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/hamas-app-telegram-iran\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2023-10-19T17:00:00+00:00\"> <meta property=\"article:modified_time\" content=\"2023-10-19T17:40:24+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1281\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/cdn.parsely.com\">\n<link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-0\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1697500969g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-4\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress-next\/dist\/css\/related-posts-block-styles.min.css?m=1693499496g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1696959155g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=7dab012cdc88b5676610\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/77686\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.3.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=77686\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fhamas-app-telegram-iran%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fhamas-app-telegram-iran%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-77686 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/hamas-app-telegram-iran\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.561946902655\">\n<div class=\"single-article__header-content\" readability=\"30.155172413793\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/geopolitics\/\"> <span>Geopolitics<\/span> <\/a> <\/li>\n<\/ul>\n<p> The administrators of a news site linked to Hamas have struggled to keep it online amid fighting with Israel. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"427\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran.jpg?resize=640%2C427&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-2.jpg?resize=1536,1025 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-2.jpg?resize=505,337 505w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-2.jpg?resize=1012,675 1012w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-2.jpg?resize=1264,843 1264w\" sizes=\"(max-width: 1012px) 100vw, 1012px\"><figcaption> Fighters from the Ezzedine al-Qassam Brigades, the armed wing of the Palestinian Hamas movement, attend a memorial service for the leader of the brigade Ibrahim Abu Al-Naja in Rafah in the southern Gaza Strip on June 10, 2017, after he was killed in an “accidental explosion” earlier in the month.<br \/>\n(SAID KHATIB\/AFP via Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"36.420539730135\"><body readability=\"73.390037095919\"><\/p>\n<p>An Android app designed to share updates for supporters of Hamas\u2019 military wing is linked to a long-running Hamas-linked cyber espionage group, according to <a href=\"https:\/\/www.recordedfuture.com\/hamas-application-infrastructure-reveals-possible-overlap-tag-63-iranian-threat-activity\">analysis by the security firm Record Future<\/a> that sheds light on how the group is attempting to spread its messaging amid ongoing fighting with Israel. <\/p>\n<p>The app in question was posted to a Telegram channel associated with the Izz al-Din al-Qassam Brigades four days after fighting began, and was configured to communicate with a news site linked to the group.<\/p>\n<p>That site has only intermittently been available amid fighting between Hamas and Israel. It is unclear why, but Recorded Future\u2019s analysts speculate that it could be the result of providers refusing to work with the group or as a result of the <a href=\"http:\/\/techcrunch.com\/2023\/10\/09\/hacktivism-erupts-in-response-to-hamas-israel-war\/\">relentless wave of tit-for-tat distributed denial-of-service attacks<\/a> from all sides in the conflict.<\/p>\n<p>The operators of the news site have been working to keep it online by moving it between several different infrastructure providers. Analyzing that movement revealed several clusters of domains with a shared Google Analytics code that showed signs of connections to a group Recorded Future tracks as TAG-63 \u2014 tracked otherwise as <a href=\"https:\/\/www.cybereason.com\/blog\/operation-bearded-barbie-apt-c-23-campaign-targeting-israeli-officials\">APT-C-23<\/a>, <a href=\"https:\/\/www.kaspersky.com\/about\/press-releases\/2015_hunting-desert-falcons--the-first-known-arabic-cyber-espionage-group-attacking-thousands-of-victims-globally\">Desert Falcons<\/a>, <a href=\"https:\/\/blog.talosintelligence.com\/arid-viper-targets-palestine\/\">Arid Viper<\/a> or <a href=\"https:\/\/symantec-enterprise-blogs.security.com\/blogs\/threat-intelligence\/mantis-palestinian-attacks\">Mantis<\/a> \u2014 perhaps the longest-running Arabic cyber operations group publicly known.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>With Israel carrying out a siege against Gaza in the aftermath of a Hamas attack that left more than 1,300 people dead and some <a href=\"https:\/\/english.ahram.org.eg\/NewsContent\/58\/1262\/510364\/War-on-Gaza\/War-on-Gaza\/AlQassam-Brigades-claim-possession-of-over--captiv.aspx\">200 kidnapped<\/a>, electricity and internet access in the enclave has been severely limited or shut off. Recorded Future\u2019s analysis indicates that Hamas may be working with groups or individuals outside of Gaza \u2014 potentially including in Iran \u2014 to keep its news site available online. <\/p>\n<p>One cluster of domains associated with the site includes references to Iran in some subdomains, including the word \u201cIran,\u201d and Farsi terms for \u201cattendant\u201d or \u201ccomrade,\u201d as well as \u201cdirector\u201d or \u201cmanager.\u201d<\/p>\n<p>\u201cWhoever was responsible for running these assets was potentially doing so from outside the territories,\u201d said a Recorded Future analyst who spoke with CyberScoop on the condition of anonymity given the heightened security concerns. \u201cWe don\u2019t have the information to suggest that that did occur, but we find it suspicious that they kept trying to run that.\u201d <\/p>\n<p>The researcher who spoke with CyberScoop emphasized that the links to Iran are far from conclusive. \u201cIt is one of the hypotheses,\u201d the researcher said. <\/p>\n<p>While policymakers and researchers have puzzled over Iran\u2019s role in planning the most recent Hamas attack, Tehran has a well-documented history of providing the terrorist group with support. \u201cIran\u2019s Islamic Revolutionary Guard Corps (IRGC), and specifically the Quds Force, is the only known entity from Iran that provides cyber technical assistance to Hamas and other Palestinian threat groups,\u201d Recording Future analysts note in their report.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The Hamas cyber operation, TAG-63, to which the news site is linked, began operating as early as 2011 and was perhaps the first known group of Arabic-speaking cyber mercenaries, <a href=\"https:\/\/www.kaspersky.com\/about\/press-releases\/2015_hunting-desert-falcons--the-first-known-arabic-cyber-espionage-group-attacking-thousands-of-victims-globally\">Kaspersky reported in 2015<\/a>. The group has since targeted thousands of victims in Israel, Palestine and around the world using various malware to steal data and information. <\/p>\n<p>The group is known to target government, military, financial, media, education, energy and research and policy entities, according to an <a href=\"https:\/\/symantec-enterprise-blogs.security.com\/blogs\/threat-intelligence\/mantis-palestinian-attacks\">April 2023 analysis of the group\u2019s activity by Symantec\u2019s Threat Hunter Team<\/a>. That analysis documented the group\u2019s deployment of \u201ca refreshed toolset and going to great lengths to maintain a persistent presence on targeted networks\u201d that used updated versions of its custom Micropsia and Arid Gopher backdoors.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.2092511013216\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran-1.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/hamas-app-telegram-iran\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hamas-linked app offers window into cyber infrastructure, possible links to<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1096,1097,302,1058,513,514,1098,288],"tags":[1099,1100,306,1061,517,518,1101,294],"class_list":["post-1911","post","type-post","status-publish","format-standard","hentry","category-arid-viper","category-desert-falcon","category-geopolitics","category-hamas","category-iran","category-israel","category-tag-63","category-threats","tag-arid-viper","tag-desert-falcon","tag-geopolitics","tag-hamas","tag-iran","tag-israel","tag-tag-63","tag-threats"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/arid-viper\/\" rel=\"category tag\">Arid Viper<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/desert-falcon\/\" rel=\"category tag\">Desert Falcon<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/geopolitics\/\" rel=\"category tag\">Geopolitics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/hamas\/\" rel=\"category tag\">Hamas<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/iran\/\" rel=\"category tag\">Iran<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/israel\/\" rel=\"category tag\">Israel<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/tag-63\/\" rel=\"category tag\">TAG-63<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a>","tag_info":"Threats","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/1911","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=1911"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/1911\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=1911"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=1911"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=1911"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1911,"date":"2023-10-19T17:00:00","date_gmt":"2023-10-19T17:00:00","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=77686"},"modified":"2023-10-19T17:00:00","modified_gmt":"2023-10-19T17:00:00","slug":"hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2023\/10\/19\/hamas-linked-app-offers-window-into-cyber-infrastructure-possible-links-to-iran\/","title":{"rendered":"Hamas-linked app offers window into cyber infrastructure, possible links to Iran"},"content":{"rendered":"